Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s QLogic qla2xxx storage driver can corrupt kernel memory because an initialization structure is accessed incorrectly. A successful trigger could crash a system or potentially affect data confidentiality and integrity. Risk is concentrated on systems using the vulnerable driver, especially storage-critical servers.
Executive priority
Treat as a high-priority infrastructure update for exposed storage servers because kernel memory corruption can cause outages or broader compromise. Use normal accelerated patching for confirmed qla2xxx hosts; systems without that driver or hardware should be deprioritized after validation.
Technical view
CVE-2024-42288 corrects an improper dereference of the qla2xxx Init Control Block. The supplied CVSS 3.1 score is 7.8, requiring local access and low privileges, with potentially high confidentiality, integrity, and availability impact. The sources do not explain the precise trigger conditions or demonstrate exploitation.
Likely exposure
Exposure likely requires a vulnerable Linux kernel with the qla2xxx driver and relevant QLogic storage hardware or driver path in use. Not every Linux system is exposed. The supplied version metadata is ambiguous, so kernel or distribution advisories should determine whether a specific build contains the correction.
Exploitation context
The source bundle does not establish active exploitation, and the CVE is not identified as being in KEV. Its CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. Public exploit availability and practical reliability are not documented in the supplied evidence.
Researcher notes
The record attributes the defect to incorrect Init Control Block dereferencing but provides no CWE, trigger details, proof of concept, or exploitation evidence. Multiple stable-branch commits indicate backports exist. The supplied affected-version entries are not sufficiently clear for exact boundary claims; evaluate distribution kernels by package advisory and incorporated patch.
Mitigation direction
- Apply the vendor or Linux distribution kernel update containing the referenced stable correction.
- Prioritize storage hosts where qla2xxx is loaded or QLogic Fibre Channel hardware is present.
- Follow distribution guidance when affected-version status cannot be determined from kernel version alone.
- Restrict local access and unnecessary privileges until affected systems are updated.
Validation and detection
- Inventory kernel builds and identify systems loading or packaging the qla2xxx driver.
- Compare distribution package revisions against applicable vendor security advisories.
- Confirm the installed kernel includes the relevant upstream or backported correction.
- Reboot into the updated kernel and verify the running version afterward.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42288 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/dae67169cb35a37ecccf60cfcd6bf93a1f4f5efbCVE reference, Linux
- https://git.kernel.org/stable/c/87db8d7b7520e99de71791260989f06f9c94953dCVE reference, Linux
- https://git.kernel.org/stable/c/b0302ffc74123b6a99d7d1896fcd9b2e4072d9ceCVE reference, Linux
- https://git.kernel.org/stable/c/2a15b59a2c5afac89696e44acf5bbfc0599c6c5eCVE reference, Linux
- https://git.kernel.org/stable/c/571d7f2a08836698c2fb0d792236424575b9829bCVE reference, Linux
- https://git.kernel.org/stable/c/8192c533e89d9fb69b2490398939236b78cda79bCVE reference, Linux
- https://git.kernel.org/stable/c/c03d740152f78e86945a75b2ad541bf972fab92aCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.